1c9358bf9b8fe6058e11d0c60e8b1d756cab9978a8e2836e3c9a90e34871dc74

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
Size 2.6MB
Sample260930-1lex1sba69
SHA256 1c9358bf9b8fe6058e11d0c60e8b1d756cab9978a8e2836e3c9a90e34871dc74
MD5 417c01da6ac9662dea9017e872951102
SHA1 47bc5d260c700942c5328294e252959430be189e
SHA512 09e95db3661e6f2103aeee1604425837c14676ac07259d2d9c451d8999e0210035651ffd36f290bd7427aa1cf9bb5512cfd03a0b83093d055b7c2bb885597862
SSDEEP 49152:GKDrYqvDz5ljf9kx6RVrhm63jHwySPONWRqb7NrMTzcPWwcQtF0YX:GmzvDz5hCxWrhm63jQBPONWRg7NrY637
TLSH
T128D5BF02FB424073E993023195BBA77E493DAE60A334D5D793C438694D726E2663E3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4512	powershell.exe

Downloads MZ/PE file 25 IoCs

flow	pid	Process
8	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
8	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
8	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
8	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
8	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
10	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
10	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
11	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
3	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	myip.ipip.net

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	zuhaoclient.exe

Executes dropped EXE 14 IoCs

pid	Process
1512	zuhaoclient.exe
1056	update.exe
5992	curl.exe
5204	curl.exe
2512	zuhaoclient.exe
5648	update.exe
3872	curl.exe
2656	curl.exe
3424	zuhaoclient.exe
256	zuhaoclient.exe
6120	GGImgTools.exe
5516	zuhaoclient.exe
3816	zuhaoclient.exe
5572	zuhaoclient.exe

Loads dropped DLL 22 IoCs

pid	Process
2512	zuhaoclient.exe
2512	zuhaoclient.exe
3424	zuhaoclient.exe
3424	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
3424	zuhaoclient.exe
256	zuhaoclient.exe
256	zuhaoclient.exe
6120	GGImgTools.exe
6120	GGImgTools.exe
6120	GGImgTools.exe
6120	GGImgTools.exe
6120	GGImgTools.exe
6120	GGImgTools.exe
5516	zuhaoclient.exe
5516	zuhaoclient.exe
3816	zuhaoclient.exe
3816	zuhaoclient.exe
5572	zuhaoclient.exe
5572	zuhaoclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3740	cmd.exe
2744	cmd.exe
1328	cmd.exe
2520	cmd.exe
4796	cmd.exe
3000	cmd.exe
5348	cmd.exe
5944	cmd.exe
3116	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zuhaoclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zuhaoclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zuhaoclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	curl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zuhaoclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuhaoclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{0128FD3C-0322-49D1-91E1-E5F0531DDA81}	zuhaoclient.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	zuhaoclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 6b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	zuhaoclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112866b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	zuhaoclient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1512	zuhaoclient.exe
1512	zuhaoclient.exe
1512	zuhaoclient.exe
1512	zuhaoclient.exe
1056	update.exe
1056	update.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
5648	update.exe
5648	update.exe
3424	zuhaoclient.exe
3424	zuhaoclient.exe
3424	zuhaoclient.exe
3424	zuhaoclient.exe
3424	zuhaoclient.exe
3424	zuhaoclient.exe
256	zuhaoclient.exe
256	zuhaoclient.exe
256	zuhaoclient.exe
256	zuhaoclient.exe
256	zuhaoclient.exe
256	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
4512	powershell.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
5516	zuhaoclient.exe
5516	zuhaoclient.exe
5516	zuhaoclient.exe
5516	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
5516	zuhaoclient.exe
5516	zuhaoclient.exe
3816	zuhaoclient.exe
3816	zuhaoclient.exe
3816	zuhaoclient.exe
3816	zuhaoclient.exe
3816	zuhaoclient.exe
3816	zuhaoclient.exe
4512	powershell.exe
4512	powershell.exe
5572	zuhaoclient.exe
5572	zuhaoclient.exe
5572	zuhaoclient.exe
5572	zuhaoclient.exe
3232	WMIC.exe
3232	WMIC.exe
3232	WMIC.exe
3232	WMIC.exe
5572	zuhaoclient.exe
5572	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
2512	zuhaoclient.exe
4188	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1512	zuhaoclient.exe
Token: SeShutdownPrivilege	2512	zuhaoclient.exe
Token: SeShutdownPrivilege	3424	zuhaoclient.exe
Token: SeShutdownPrivilege	256	zuhaoclient.exe
Token: SeShutdownPrivilege	2512	zuhaoclient.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	5516	zuhaoclient.exe
Token: SeShutdownPrivilege	3816	zuhaoclient.exe
Token: SeShutdownPrivilege	5572	zuhaoclient.exe
Token: SeIncreaseQuotaPrivilege	3232	WMIC.exe
Token: SeSecurityPrivilege	3232	WMIC.exe
Token: SeTakeOwnershipPrivilege	3232	WMIC.exe
Token: SeLoadDriverPrivilege	3232	WMIC.exe
Token: SeSystemProfilePrivilege	3232	WMIC.exe
Token: SeSystemtimePrivilege	3232	WMIC.exe
Token: SeProfSingleProcessPrivilege	3232	WMIC.exe
Token: SeIncBasePriorityPrivilege	3232	WMIC.exe
Token: SeCreatePagefilePrivilege	3232	WMIC.exe
Token: SeBackupPrivilege	3232	WMIC.exe
Token: SeRestorePrivilege	3232	WMIC.exe
Token: SeShutdownPrivilege	3232	WMIC.exe
Token: SeDebugPrivilege	3232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3232	WMIC.exe
Token: SeRemoteShutdownPrivilege	3232	WMIC.exe
Token: SeUndockPrivilege	3232	WMIC.exe
Token: SeManageVolumePrivilege	3232	WMIC.exe
Token: 33	3232	WMIC.exe
Token: 34	3232	WMIC.exe
Token: 35	3232	WMIC.exe
Token: 36	3232	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3232	WMIC.exe
Token: SeSecurityPrivilege	3232	WMIC.exe
Token: SeTakeOwnershipPrivilege	3232	WMIC.exe
Token: SeLoadDriverPrivilege	3232	WMIC.exe
Token: SeSystemProfilePrivilege	3232	WMIC.exe
Token: SeSystemtimePrivilege	3232	WMIC.exe
Token: SeProfSingleProcessPrivilege	3232	WMIC.exe
Token: SeIncBasePriorityPrivilege	3232	WMIC.exe
Token: SeCreatePagefilePrivilege	3232	WMIC.exe
Token: SeBackupPrivilege	3232	WMIC.exe
Token: SeRestorePrivilege	3232	WMIC.exe
Token: SeShutdownPrivilege	3232	WMIC.exe
Token: SeDebugPrivilege	3232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3232	WMIC.exe
Token: SeRemoteShutdownPrivilege	3232	WMIC.exe
Token: SeUndockPrivilege	3232	WMIC.exe
Token: SeManageVolumePrivilege	3232	WMIC.exe
Token: 33	3232	WMIC.exe
Token: 34	3232	WMIC.exe
Token: 35	3232	WMIC.exe
Token: 36	3232	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4188	WMIC.exe
Token: SeSecurityPrivilege	4188	WMIC.exe
Token: SeTakeOwnershipPrivilege	4188	WMIC.exe
Token: SeLoadDriverPrivilege	4188	WMIC.exe
Token: SeSystemProfilePrivilege	4188	WMIC.exe
Token: SeSystemtimePrivilege	4188	WMIC.exe
Token: SeProfSingleProcessPrivilege	4188	WMIC.exe
Token: SeIncBasePriorityPrivilege	4188	WMIC.exe
Token: SeCreatePagefilePrivilege	4188	WMIC.exe
Token: SeBackupPrivilege	4188	WMIC.exe
Token: SeRestorePrivilege	4188	WMIC.exe
Token: SeShutdownPrivilege	4188	WMIC.exe
Token: SeDebugPrivilege	4188	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	zuhaoclient.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2512	zuhaoclient.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1512	4176	2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe	90
PID 1512 wrote to memory of 1056	1512	zuhaoclient.exe	91
PID 1056 wrote to memory of 3740	1056	update.exe	92
PID 3740 wrote to memory of 5992	3740	cmd.exe	94
PID 1056 wrote to memory of 2744	1056	update.exe	95
PID 2744 wrote to memory of 5204	2744	cmd.exe	97
PID 1056 wrote to memory of 2512	1056	update.exe	98
PID 2512 wrote to memory of 5648	2512	zuhaoclient.exe	99
PID 5648 wrote to memory of 3116	5648	update.exe	100
PID 3116 wrote to memory of 3872	3116	cmd.exe	102
PID 5648 wrote to memory of 1328	5648	update.exe	103
PID 1328 wrote to memory of 2656	1328	cmd.exe	105
PID 2512 wrote to memory of 3424	2512	zuhaoclient.exe	106
PID 2512 wrote to memory of 256	2512	zuhaoclient.exe	107
PID 2512 wrote to memory of 2520	2512	zuhaoclient.exe	108
PID 2512 wrote to memory of 6120	2512	zuhaoclient.exe	110
PID 2520 wrote to memory of 4512	2520	cmd.exe	111
PID 2512 wrote to memory of 5516	2512	zuhaoclient.exe	112
PID 2512 wrote to memory of 4796	2512	zuhaoclient.exe	113
PID 2512 wrote to memory of 5572	2512	zuhaoclient.exe	114
PID 2512 wrote to memory of 3816	2512	zuhaoclient.exe	115
PID 4796 wrote to memory of 3232	4796	cmd.exe	117
PID 2512 wrote to memory of 3000	2512	zuhaoclient.exe	119
PID 3000 wrote to memory of 4188	3000	cmd.exe	121
PID 2512 wrote to memory of 5348	2512	zuhaoclient.exe	122
PID 5348 wrote to memory of 5468	5348	cmd.exe	124
PID 2512 wrote to memory of 5944	2512	zuhaoclient.exe	125
PID 5944 wrote to memory of 5244	5944	cmd.exe	127

cURL User-Agent 4 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	14	curl/8.9.0
HTTP User-Agent header	15	curl/8.9.0
HTTP User-Agent header	21	curl/8.9.0
HTTP User-Agent header	22	curl/8.9.0

C:\Users\Admin\AppData\Local\Temp\2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_417c01da6ac9662dea9017e872951102_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_revil.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Temp\zuhaoclient.exe
  "C:\Users\Admin\AppData\Local\Temp\zuhaoclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\update.exe
    exeName=zuhaoclient.exe uiType=default showStatus=true title=租号客户端 softType=9
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\curl.exe cip.cc
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\curl.exe
        
        C:\Users\Admin\AppData\Local\Temp\curl.exe cip.cc
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:5992
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\curl.exe myip.ipip.net
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\curl.exe
        
        C:\Users\Admin\AppData\Local\Temp\curl.exe myip.ipip.net
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:5204
  - - \??\c:\users\admin\appdata\local\temp\zuhaoclient.exe
      "c:\users\admin\appdata\local\temp\zuhaoclient.exe"
      4⤵
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2512
    - - \??\c:\users\admin\appdata\local\temp\update.exe
        
        exeName=zuhaoclient.exe uiType=default showStatus=true title=租号客户端 softType=9
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5648
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\users\admin\appdata\local\temp\curl.exe cip.cc
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        \??\c:\users\admin\appdata\local\temp\curl.exe
        
        c:\users\admin\appdata\local\temp\curl.exe cip.cc
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:3872
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\users\admin\appdata\local\temp\curl.exe myip.ipip.net
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        \??\c:\users\admin\appdata\local\temp\curl.exe
        
        c:\users\admin\appdata\local\temp\curl.exe myip.ipip.net
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:2656
    - - \??\c:\users\admin\appdata\local\temp\zuhaoclient.exe
        
        "c:\users\admin\appdata\local\temp\zuhaoclient.exe" --type=gpu-process --field-trial-handle=1712,4706505750185104242,11146629248239320341,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --disable-gpu-vsync --log-file="c:\users\admin\appdata\local\temp\debug.log" --log-severity=disable --lang=zh-CN --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="c:\users\admin\appdata\local\temp\debug.log" --mojo-platform-channel-handle=1724 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
    - - \??\c:\users\admin\appdata\local\temp\zuhaoclient.exe
        
        "c:\users\admin\appdata\local\temp\zuhaoclient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1712,4706505750185104242,11146629248239320341,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="c:\users\admin\appdata\local\temp\debug.log" --log-severity=disable --lang=zh-CN --log-file="c:\users\admin\appdata\local\temp\debug.log" --mojo-platform-channel-handle=2024 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:256
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c powershell -command "Set-MpPreference -ExclusionPath c:\users\admin\appdata\local\temp"
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2520
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Set-MpPreference -ExclusionPath c:\users\admin\appdata\local\temp"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
    - - \??\c:\users\admin\appdata\local\temp\shot\GGImgTools.exe
        
        "c:\users\admin\appdata\local\temp\shot\GGImgTools.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6120
    - - \??\c:\users\admin\appdata\local\temp\zuhaoclient.exe
        
        "c:\users\admin\appdata\local\temp\zuhaoclient.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1712,4706505750185104242,11146629248239320341,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --no-sandbox --log-file="c:\users\admin\appdata\local\temp\debug.log" --log-severity=disable --lang=zh-CN --log-file="c:\users\admin\appdata\local\temp\debug.log" --mojo-platform-channel-handle=2420 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c wmic CPU get ProcessorID
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic CPU get ProcessorID
        6⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3232
    - - \??\c:\users\admin\appdata\local\temp\zuhaoclient.exe
        
        "c:\users\admin\appdata\local\temp\zuhaoclient.exe" --type=renderer --no-sandbox --log-file="c:\users\admin\appdata\local\temp\debug.log" --disable-threaded-scrolling --field-trial-handle=1712,4706505750185104242,11146629248239320341,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="c:\users\admin\appdata\local\temp\debug.log" --log-severity=disable --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
    - - \??\c:\users\admin\appdata\local\temp\zuhaoclient.exe
        
        "c:\users\admin\appdata\local\temp\zuhaoclient.exe" --type=renderer --no-sandbox --log-file="c:\users\admin\appdata\local\temp\debug.log" --disable-threaded-scrolling --field-trial-handle=1712,4706505750185104242,11146629248239320341,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="c:\users\admin\appdata\local\temp\debug.log" --log-severity=disable --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c wmic BaseBoard get Product
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic BaseBoard get Product
        6⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c wmic BaseBoard get SerialNumber
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5348
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic BaseBoard get SerialNumber
        6⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c wmic diskdrive get SerialNumber
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5944
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic diskdrive get SerialNumber
        6⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updump[1].dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1BCA2PC\updump[1].dll
Size 3.3MB
SHA256 5f11dd6735c5450f0dda2b7472bcddf3cbfc89e20aed68341eeb74eb0f2f87ac
MD5 ae8d33e1482e702e0ef272913f324a37
SHA1 a040b21c9a7282ba5bc7bbe0b3db12517127eef6
SHA512 58ef0b9fb1b7398de61b2a3042fd1f710b5f3c677e661fc639340e610cee6e5f4e264c15e551413770d51f0c39a759ad58adf49f35a56b4bb4f82cbfd63baecc
SSDEEP 98304:M89VpFRIO1zClmUNWg6HsB/J7tjIpdgMp7+:V9VpF2OJCo55MB/xtjsg1
TLSH
T176F51267339B0402E8DD49799932BE843AF6F2F01642D977119C45CE3B3A9A1E631E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K2UU5U9F\1[1].txt
Size 3B
SHA256 a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3
MD5 202cb962ac59075b964b07152d234b70
SHA1 40bd001563085fc35165329ea1ff5c5ecbdbbeef
SHA512 3c9909afec25354d551dae21590bb26e38d53f2173b8d3dc3eee4c047e7ab1c1eb8b85103e3be7ba613b31bb5c9c36214dc9f14a42fd7a2fdb84856bca5c44c2
MD5 SHA1 SHA512

Submit Download

fastcgi.conf

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\fastcgi.conf
Size 1KB
SHA256 553f426bb9dbf99e4e523420f24ae2def7b7a48da5690c7565ca8c1bfc6885d1
MD5 c7410cb0f3605b4201888c91fba1ded2
SHA1 5b545f270a785bf6f03ab396e94ed2f73c179fc5
SHA512 fd9a36adc65ed62a86ed3a7fc4553482586f4f4b69d4414de7260f4bee035d650d2694d051dd37d83c07f7a269939fbac3615576c388931844846db918ff3033
TLSH
T16B1101D22F47E6CA5A5CB1DB3CA87FA1D5147105320B912AB59C3EC473DCB7AE7A0124
MD5 SHA1 SHA512 TLSH

Submit Download

fastcgi_params

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\fastcgi_params
Size 1KB
SHA256 f54d7964c3b70a624351aa6f5acc37ac09c080edc92f9938f80935dad4750c72
MD5 1690a072b48d6a838b7006ef137e0c68
SHA1 44c362ede0a31c898498cbfd606e46b9f1f30bd5
SHA512 c64433da979dd35bbc685cbe167db78865c46a9981c3bc62bc8c8e45cdf61cc1b254249aa36a1b15f9a0d98925b071fffb8508351b707790ef339570721fe0d8
TLSH
T1A511E0C22F47F2895A58B5DB3CA87FA1D514B101320B912AB89C3EC473DCB7AD7A0124
MD5 SHA1 SHA512 TLSH

Submit Download

koi-utf

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\koi-utf
Size 2KB
SHA256 69c68412fd6e2c3118ab896cb1a496c8dd7d0c9c2457a8e0a99edf1d606ce143
MD5 cf9873a961fc52f0b4a30caf5393b630
SHA1 5afe5f88c011cc41aef4e82a6e2bdcbf8d573ec5
SHA512 2ff5c039cdb578a97aa85a658731d884883865d97e65bd0c90c00a5a71613c310cef987fc53210af7d02f69c865ab14c03759c9b0830d106df58187fe689d976
TLSH
T10B518B6698D1592C70319FBA09CF9416C7AE194B18F1CAC9B88F3DD86FF2DC425C242E
MD5 SHA1 SHA512 TLSH

Submit Download

koi-win

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\koi-win
Size 2KB
SHA256 ec4d22f1ecb84d690f0fe1073646b3cda9072904a5e4d3922e9cbb6bf0bde38f
MD5 4d74303b129125943e9150077bfde7b0
SHA1 3fe28cd5b11c84d3df706e74012a581a989db4fc
SHA512 d07fc1f4316f09cfb33c3d835c7ad16b63a4a5a16220dc74e4c259431fa40d25a22d34d68b1c79cd5526a265fda8efdbef064d8e5a6d251a8fc60f50f4567448
TLSH
T1E641412694C156241435CFB257CFDB66C2AE590B49F80AC4B88F3D9C2FF7ED8658210D
MD5 SHA1 SHA512 TLSH

Submit Download

mime.types

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\mime.types
Size 5KB
SHA256 173da2ee9b08323bcfd77791e727c5f1df7f22072f65b4aa3a36d4dd9b1e2bd8
MD5 6b1b85cbf70154fc051e8057dc72b2ce
SHA1 fd2ce3ef17c7f703aab89d100387b258b3e9263e
SHA512 e91d4f79236a769b7208de7135503d810ba517679937f00eaec6b24fd9461cbf6c5302763531307b575293f1797e4b5b9075172f596e544776acde5b5ab44e96
SSDEEP 96:F+9bL2lolI8IaLI9GublInpMi9Z46O4FmHPm:Y1L2lcXxLKGfnpMi9Z46O4FmHPm
TLSH
T118B1F1D2691B44E15FF660BFAFB181D4F8A2202F1D839AC07E4D864C1F3525CC76A799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nginx.conf

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\nginx.conf
Size 3KB
SHA256 8624d2791ba5ac86b1f80d7b8b4fa2431f311d4180d7c3e20f1bc9c93662b94f
MD5 b7a52005403985ed7d5500cb7099a04d
SHA1 dbee2edfee5dd86c12518d004af795cb7d7fd10a
SHA512 53d0429f4136117948844fb50ffd35c2a77d72734ce7def0560bfc8929e13eb96d96e29e02c4b9b38b8c7528e084f1f0d479d67dc371a1860c6a4a368bb215e7
TLSH
T13D818E628917281F9F7E466F7520E649FB0D609FB568C3C9B34D830B5FB520AC6A0978
MD5 SHA1 SHA512 TLSH

Submit Download

scgi_params

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\scgi_params
Size 653B
SHA256 7f43a9485cacc217fd5c87e35b19954a0c62219acd41c0c95f52a291b7676cb6
MD5 019de4211c9933877bf5d661c344c0fa
SHA1 fa0c2e3e2f256b65de0710a2b727046bff41ea39
SHA512 569553c6a2e127fed80347c36eb0e1f03900383629064f9238f7bbf36ec9d7ea600566181d8484d5a84c92d59e174e2cb3aad3a4ef09a763fbe865e1a36d39b1
TLSH
T116F049F96C47E2CA8A1CF61B159D7A61C9187542341BD125B9DC2DC0639E02ADB902F0
MD5 SHA1 SHA512 TLSH

Submit Download

server-cert.pem

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\server-cert.pem
Size 1KB
SHA256 637fb780aafb6bedc8b592be86afe2b72ba0b4cde1bcccac05a335c5c6cc0930
MD5 6bec7f5c328a963118cc73039a90b0a4
SHA1 226632e025508d878e1fbb651db12dc32da53b80
SHA512 01eee41c6b45b30f214fa8209788b05d6128371a10cfa48fc40820779dca37c3bf56004939a058c1504b0b7b349e8954f07162d9cc513b881a31a329b92548f9
TLSH
T19D31D79B8E60B8ACBC57F5B6891F10540C7424ABADC1FC774D14214247E4D89E2FD4AB
MD5 SHA1 SHA512 TLSH

Submit Download

server-key

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\server-key
Size 1KB
SHA256 1fe63a43a163abeaa09d815acfd546dc1ad5a27649900635f0a0d8824075cb2b
MD5 a888eee3cf030a7e4cde8894a6513681
SHA1 0a592a8c2ac3bf97436cf099c91a09122868a0c0
SHA512 dd09948846ed3921a43b80ec2ef114329880670078eff178aa95605a56e8faa122e92f46ad537791e2ede85ef293d146f700a8a4cabecc7dd64fecedff4570b2
TLSH
T15D312BC6DD64D5A04FF0D22D11C679CDDD7BE2771D8940238027984A1901FB07CDD921
MD5 SHA1 SHA512 TLSH

Submit Download

server-cert.pem

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\store\server-cert.pem
Size 1KB
SHA256 aea6420635ae8209ec77e9e8819f587024772a99a662b13ad5004d34cc872423
MD5 18a40e55978594e48354ef71ce4dfbcf
SHA1 7a2eef03a2db47133b857c235c6432d05dfc411a
SHA512 a53337b45aa7bfe951356c1e961da93515408c6156537e6a2b994958f33e711d55d6aed0e2a9c0fc030e094fb7a82fac8721427ede17c94747d8541638291648
TLSH
T1FC31B71A4D60B7A47C479270DA7B15AC145C2097DC8F9C7B0CB96407AF1D850F79C97E
MD5 SHA1 SHA512 TLSH

Submit Download

server-key

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\store\server-key
Size 1KB
SHA256 ea1156f199f7907b7cd4e783b5c1b9c42610e5cd1709b41b31d402ac5e67cca2
MD5 e4cfdfb4821ad9d0ec2efb6fba8314c9
SHA1 211781d9ee6437b5f7e4b0b2641a41734e7276a7
SHA512 229fa2fd8f27aac22b13012b06fc530f196751572d38a2842d5a9f9caa52abb16b000b299faee8c6bac0350ba44e3dc3b35c564e62f9ca329c0474692548caa0
TLSH
T1DB310B330C115E509839DE21DE841B959135E533901B24F34CA2997FA5036F8B028D08
MD5 SHA1 SHA512 TLSH

Submit Download

uwsgi_params

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\uwsgi_params
Size 681B
SHA256 651718ed1d4b04459e3a5268531f3d74dc71ee67c5eb27f0d1a330be6776c51e
MD5 16c1f3bc1a73fa046b6f8818968b25e0
SHA1 a43fb0f39bf214962fe58d59844446100a2d698c
SHA512 e6934d1e563ef9b449199499899cf93f2889f81b219c7ef194879b8740ff2fb6e059839e90960a5c8d7d2af7c89b162d2e7785b27b347a11251319c9fcac0068
TLSH
T1EE01AFE93C47E38F862CB5D70999792287247402349B5025BC5E2EC763CC428DEF093C
MD5 SHA1 SHA512 TLSH

Submit Download

win-utf

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\conf\win-utf
Size 3KB
SHA256 9bef138f95a8d1b7718a42673c5667f8bab9ab34d1e2628a43d820b1d4766bd8
MD5 4bc7943e899fa8112d583c7d90785f7f
SHA1 925a725cc43a5b881113c9fd671b4d368be42704
SHA512 2e53465477763106ccc4299f8c6d358b6ecbd68cc489a95cd07c45dbbb04f8cd81b4761c623781d9f739db3fac28785e3b13f640ef6f5a49c23cb3857d6cf6eb
TLSH
T1A971462A98D1953E34358FB609CBD512C66E094708F1CAC9B8DF38986FF2CD436C642E
MD5 SHA1 SHA512 TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\README
Size 543B
SHA256 0f4908c9fc73ea40c264da0ab23041c9926ddfa3c8c639f734900a4c203491a5
MD5 27d0f5bee63ab0eb6a6c3f07dfe01640
SHA1 dd031bbdd8f2885ffe5a57a3b9faa8640d040b07
SHA512 2f24663aff3423fa44286bb0f1b60b4e1dc52863f55a414d35d7c1a13911383a597ea5a24b7e8d2af4b96562baf18c6c1db18dcb4b58b4c1db1241b8b9afb458
TLSH
T1ACF0E14686C04E498F6ACB9454EDB330AF7643CE215147810C58A50D31414357195B4E
MD5 SHA1 SHA512 TLSH

Submit Download

geo2nginx.pl

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\geo2nginx.pl
Size 1KB
SHA256 710cc6ea2fefe73c908addf6cb84c08f1da1310ddd9fba87f3bd8c87e3d4a350
MD5 35670709be7fc98fb47013f565f55730
SHA1 f5b8473781ef13c55f9e9d4df3c615cb1fd58d05
SHA512 d33685d39c6cd521d6e9fa6d0ab39cee125d9c7484d32afaef1832ac78bef35fc2a7b1908761198e547cd5bd61cdf5cda1e6bcebbf04e928dd13dc73a7a4cac9
TLSH
T11E2162DE27C6325C7BB072E42BFFE4A4DC84718206B26760B944A5DD1170E690978A6F
MD5 SHA1 SHA512 TLSH

Submit Download

koi-utf

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\unicode2nginx\koi-utf
Size 5KB
SHA256 cbb9fbae8d0987b4a1547fa48135ed1c890f58e7789acee064026678dbef5cd6
MD5 9c4e84058416af6184a8cfc10a9f6797
SHA1 f70df32d3dddbcb4654e76b9b7d2f98fa7e1821f
SHA512 8415476dd21e38435b4637722df20ea35d6781e4b36f7e3b28018c69061436849e71bf2604296b861eb7dbfe670f06c160f010449338063bea7ddad26fd677ec
SSDEEP 96:5FB6yDdLYlPbcPj77qzN6RAQtVP09etORf9Uk:5P6KWlA/uPKVP+eId
TLSH
T126C1CD4979C14856FB699B737D3BCCE9008286C727C0BEA0F02A50E6CF529FD3997496
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicode-to-nginx.pl

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\unicode2nginx\unicode-to-nginx.pl
Size 1KB
SHA256 1cc5bfd4262ea8db2fc575459d1e3b3fd2a4a5a8b2697f1080d7514f5a4d7910
MD5 140f9cde0e1c5a65dec1099df664e2ce
SHA1 ef268a90eb276c39978296ea16f7129ca7d2528b
SHA512 0e4996f3de525c35effc10e32281224406c8b06c3b0e81f9452d28e64531413fd8b00ee906e792661e5f36557dcd5f35f1ceb8428a431e39bf247abf4adf19a7
TLSH
T1B7115485C3AEAC50DB92E56C0AE2B205467D5396FCCF7E004D4C039C40CD1B443552AF
MD5 SHA1 SHA512 TLSH

Submit Download

win-utf

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\unicode2nginx\win-utf
Size 5KB
SHA256 295ec71cb7b92198c02f4042727147b3ea069dc61d78693725783ce0ac74ec02
MD5 7bb4593f2ed0dd23fa6d825f440012a5
SHA1 b51ae32efab92acbcff096a8b41f404120d2cd17
SHA512 f59d85b2e70ad5060981c4a758584e431656cbb6b3c084a251ada3b2090ac374428586b04aaf89f2c4c3775ada1bb2f4988f5dcf1aceebcf5e0abe98e70ae1c9
SSDEEP 96:fx0yQt9uaYlxbhlmspZkjgWAza50YTiaXRrUgPlqen:pati1lmjRXT1tqen
TLSH
T168B10B4D79C0DA217B37AF752E5BC8DC058616CB08C4BE84B04F81D28F649F9BC55AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nginx.vim

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\vim\ftdetect\nginx.vim
Size 198B
SHA256 3ce32b22f5c741f95ec432aad87cce5ec02b6e41eecc0a5e1177018ca455a043
MD5 9e2e58984ec202ccbfccf056aee69df5
SHA1 af7d89670f0cd13b3657d6c15ec170434e645e1a
SHA512 bc4a49582d2397bdb3d9f30061a5bfb176fc518737f5dc032e0edb1c492e76f48369643ff1b4a40cb51341c7950982c7109f8e10fd69bb702ad5dde746aacecf
TLSH
T173D0E91133799E7A8BCA3BBB51CE92159EF21FD1A7C3D30C2551306B75417CA3081182
MD5 SHA1 SHA512 TLSH

Submit Download

nginx.vim

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\vim\ftplugin\nginx.vim
Size 29B
SHA256 ed7a438f9238b4054ed58a88a15625e5a3984fb07f6ed0395b062c04545adea8
MD5 cd40fd0447441adb1344e2871784fb14
SHA1 e3a1d6f38495d2ef69bcdc1bbb44564e75f7c34a
SHA512 561580bb014544bdda70738a528478c8ac6ff62ca673d25205385c125d7985a581e3d4de2e2ea2b0a04f4ad8699f66f5264e9d59316255fa40125a00b81712cd
MD5 SHA1 SHA512

Submit Download

nginx.vim

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\vim\indent\nginx.vim
Size 250B
SHA256 983c89c6ebcd4b6f61dcba4424608890d0deae79a21c0830441917e1eb54b358
MD5 82273d127ff607bf6db1268d32803c01
SHA1 ad50377b0f08adda4be4b8ca12300ecab4bbb26e
SHA512 ef53628831798b9cdf053f3ef648c1e9ad81ca8b2a2e63fc396e9827707f7d7bfffdcae73270c23a468227dc3612af180ae81c588e4112a2f474512a8e4f1070
TLSH
T188D0A7052262708AB7C707A5BD4B2D9EA563C131074CC35040D8E08C997239C6EED289
MD5 SHA1 SHA512 TLSH

Submit Download

nginx.vim

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\contrib\vim\syntax\nginx.vim
Size 110KB
SHA256 3d0bccd6ed64081a4a989fa6dcc75db20d6c468d4fdf589dd2f595e6d426aee7
MD5 838d3b9067b0123020a2783136b7ce05
SHA1 f3360f749930f8652de1b783be3b3481b48ba992
SHA512 54e90f075da55ee734dbeeac281f3a240a885269bc0bbe1084f91c1570d8ecdc6a872ea346a878530d826996d978b02765ff5342762284e3eeffc77428146a7e
SSDEEP 768:ubcmRa66eGXNDrvNHR73evV54+hmqLIKdwEAVim3rAHWDDVBbIQdiETAMBGU6Ibv:httoVDDH0E83j39i30P
TLSH
T158B3364336922B408C64C76BA296E59E2F29F69BC70E0DFC7DB483D98B99500D45F80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CHANGES

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\CHANGES
Size 316KB
SHA256 341a70cfa9c5032e21489d31c5a3f218abcd30e583870a5738603c753ed24aa2
MD5 2855a36d5905cb82543f1d2cb77b9af6
SHA1 12c5cb88df203c8201f4792a9eded2fc033d53c8
SHA512 c904ac79168337c177287afe091da472bff9e6943e3499ddda9be4ec88e3f24879d18a308bbdd3cfd86fece3c4aae382fbfc7d3cc5e513490f184c3d4462c00b
SSDEEP 1536:XOKO+99qo+ZXsam0eAW6Kkr4z/OxdfAwPGbVR+mOuWNBN6PJwv4KkaFqSmy8EMpV:+Iw4ZlwP4+m9Wfiq8nJBU8
TLSH
T13E64A61676C0232508D746F17ECF02E1F60841EB1349AEA97C0C476CBF579EAA2AF9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CHANGES.ru

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\CHANGES.ru
Size 484KB
SHA256 af7b72e2fe98d01ca71199431757bedd5ad2cb44a7a7f5fceafc4cfd6a466636
MD5 56203d8632327138a6e906628119ac9b
SHA1 0269bb8dce8dc507ca59b03046fb0c488732f1b0
SHA512 88fb2ccf6c3a49edc8083a05266f1bc747f1fa75d89fead46fa5cd8ac99d7e2bd8eeedd2849a2d6fa4e64b0ae961a00cc4a0a6b3bebfb4343f8ef05938d0d71d
SSDEEP 12288:FXHRSM6zpjTNagzp6kdTutt60DKqdTjaLGYdwXkA7+v7KsQt9M/Pg29ag5qWrGKl:Jq
TLSH
T162B45B2656EB489E5102A87BDC486D08BDF740FFBFA75212397C2D7E3BD2124826614F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\LICENSE
Size 1KB
SHA256 6ee1b7412796080f337b4c8d9e72342d0edcd39705dcdfcc41d013b6c30aa1c3
MD5 79ad2eb837299421c4435dedc8897b3d
SHA1 8a9b83ae2546cd1fd5f2f29adbec6a336aaceabd
SHA512 1030ecefda92e9a8cfad4b5b4b503bd8459612a822b5d42ab632a711261fa0f36e1abeff2c048cc1fa61f61d691328b7b72b59498194782b22dbd19e73700b0e
TLSH
T12621524B02040B9746D257A23DA59DC4608D903E3A235C0D2CAAB285AF3B56FE4BBC10
MD5 SHA1 SHA512 TLSH

Submit Download

OpenSSL.LICENSE

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\OpenSSL.LICENSE
Size 9KB
SHA256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a
MD5 c75985e733726beaba57bc5253e96d04
SHA1 c5c8a68f4b80929b3e66f054f37bb9e16078847f
SHA512 07bdeb77b6ebe1f18ba5285d98a05ac53502a82837118e194d81384bbb9c1a8e7bb7ba627df288c770e9e97599e24a5135e45546cbf493330773c6b9921ff5b6
SSDEEP 192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:UIvlKM1zJlFvmNz5VrZ
TLSH
T19722512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCRE.LICENCE

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\PCRE.LICENCE
Size 3KB
SHA256 15bc778a1f7e1f857d57abab4181749a06ad1d1f9420d5c9e3c23ef8c991b025
MD5 43cfa999260dd853cd6cb174dc396f3d
SHA1 cc7132d685cfac1cac53709962b52590e160450f
SHA512 262ff2f960fd72fd034449932ed75cf2c062f1ad9a431637ff949dd863f6104ae995716f396f00a2602a1a483da6aaf6acd7406827db242a7bdc0bd826558fd0
TLSH
T10871C76B6D48073209F2D2A5740EBB84F71D903E362B1809381E6354630B92DDDFF05B
MD5 SHA1 SHA512 TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\README
Size 49B
SHA256 691626fab75efb683563712cdb72e8d25ff50f3aefe71a770db06a0406cc825d
MD5 6a35d7240f0011220c3ae328e9e0d5ec
SHA1 62e50dec0130ae0d88719d0025913773564460b4
SHA512 78771732fdd15bbf465dab8c80d0064f8c274c8d5f9502c216a59469045310b5bcc67fcbea3a4f6f6746600031a8c5aab68dd1ed710557d73d8852be1da8d91a
MD5 SHA1 SHA512

Submit Download

zlib.LICENSE

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\docs\zlib.LICENSE
Size 983B
SHA256 d9471524f48929256576412cfac4c7e3b19897002121c99958898c48634557ea
MD5 3be0e3cf850b65d249e7c0e50ca78820
SHA1 01a3b77a9cae85a26984664bd3d7067013b16605
SHA512 ef30aeb4f9a4715bbfc88c01e35a460b34a09a0ca22c28785a8640b4b7eee0e327947c854d3cf6395b3383a3dd7161a391889898ddfd9f21e8eaf97fd9532623
TLSH
T15011ED1B779993722AE646FC3DD68DC073176E64B38E42D870AD80C837AB36212344A8
MD5 SHA1 SHA512 TLSH

Submit Download

50x.html

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\html\50x.html
Size 497B
SHA256 876766b4e80133fd490603e073d3567425b88794828a9292104244c9e40875ed
MD5 5a719a793405561b1a13e6cb1f403d88
SHA1 835b9dec419c01420e78602527a9fba8c463521c
SHA512 81a2bb82a89a8e698a267fd925367ffa4bb4ee02e482d670835ae8621751605ce856fab051c9770e8e3cb94f63fb6dd03284affe4e1161f57c1bf9178b3da472
TLSH
T194F09E8EB210136B94210310AC86A6527206270812B7857479CAC9B2FAA6E12F9376E8
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\html\index.html
Size 615B
SHA256 fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de
MD5 7df3d7cf3358af3f470ac7229387ef94
SHA1 c51a3f0e6de4eb802d5630941c3fd9e1d0efae4b
SHA512 098db3badb76a319c211d685b869e15bbc51e2658a912514b253d2a5ef3a61981dad1726f1ccb494f21b7869e655b88446c5c5c91fd76d4e33885a0b5aef3bad
TLSH
T152F0029BE3002227B48343013CB35A21775503E40354CB5578C74DD3EF2A913F4175B8
MD5 SHA1 SHA512 TLSH

Submit Download

nginx.pid

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\logs\nginx.pid
Size 7B
SHA256 6bb76c2ba5f646e159c1988446833bdae63bcda539a773661e4473602826c175
MD5 eac68ae09fe4804577f4767f7519f7d1
SHA1 ba581c99e7ccee1871a369399615c7d6d7caa9bc
SHA512 f93456328cd725c317909b64c3aecbca4e32d68015c6ea636ff0ae8a35549e030749a6d51b5686ad8fd58bc07d24a8e5da0b721331078dd0429e25b96434bf18
MD5 SHA1 SHA512

Submit Download

steamAcce.bat

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\steamAcce.bat
Size 65B
SHA256 8c19f3bad5f1c34b4bf53ddf06a0fe25215b6c97758bf36b6d74ff7d897eb4f4
MD5 adb6af7d7981ebff896caa254f8f1eae
SHA1 5f70b2da14b5eaa943be4f38ab7697ffa4c0537a
SHA512 2c7f4b41512a678ec03224084775aa2912fb283411eb791fbd4fab3cd64b2dd09b4f63463df0328514d32e610bde8e05d6aa793b1c61f48a973b211569424a13
TLSH
T18AA02200CC0303808FA0802F8080A80CF0E3808E8220B22000083A80A882B000BC3038
MD5 SHA1 SHA512 TLSH

Submit Download

steamacc.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\Accelerations\steamacc.exe
Size 4.9MB
SHA256 c8c855f90f060d9492d8a0d9254e6558cc56c0b52b6d07fe8c4416b53227bbe1
MD5 3b9fab9ecfc59195279132ae1692642e
SHA1 988f7e82f7bd40cfadd33266d6044dd8bf9be775
SHA512 eaf32827a3c72bea44a1ddf4f1466deb9a57b5a62e12b1710a9bd6eb0e871bad15d5675812752cd8eeeeda269b3c95bbe79b61b391ee5a2f10b61abc6a9401e3
SSDEEP 49152:ilH6PP5jLsEQcgrI0aqy9sdoApDmA2hy5lbtnhyQspuivkAOh5PZJGQStRd9NrhH:g69TQ1oAAyovkLSRd5vqzw
TLSH
T15F367C66A7B811C5D5BAC13CCA428A27E7B2F81917309BCF04E181791F27AD92F3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BugReport.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\BugReport.exe
Size 178KB
SHA256 ac9f128c8a7cc75b2ac96f9520eedd92b183fca5c8a6b9982d33b06b0bd6f4ff
MD5 df33c038932f259db7afa967394ec515
SHA1 d6f87f7d054a8b1008c972fbbe67a44358b4d189
SHA512 1408fcdb224edb45c34205b0c3ee485b94c77d5d6e94ec3eaf77c4a1a4a290ed9a8fdd838606b06a91819fc460fa4ca7bb5e0067f966a2658bf0bcb12c522131
SSDEEP 1536:HTnh3qp/DSsEH4LStUn2EQDpTlmmn05uCztn87Do7vGV+n:Zq1HEYLStY2J9lmm05uCpn8PoqVm
TLSH
T14204C6436ADC7DD2D174437037BBABE1D36EED2896A1C08E57D00692D47C2933922BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\Common.dll
Size 3.1MB
SHA256 5b99b69b53fd55fc8f3a2e4e05b7dd2964b3fe78a533a20a6521dc3399af4dbf
MD5 9d1d7d6abd91ff50a7c19bdbd9fdc298
SHA1 1cc8e81b9b1313e4b07863d595e43b4a252aa614
SHA512 7adc5243ed652e8d552719abba1110c9a64ed50673e759668bf73f4e100907ac7e5fe146e298e30d312888819545adf71db25f6d8f2bddf41603c8933393aed2
SSDEEP 49152:O2/j1CB2XihDPNDcqadzAQ7kjTmzU5BJER3X5k6mO7NrbTMcPmFjr8h64MeHNAw8:O25CIihbadUbizU5Bix5k6F7NrkRl
TLSH
T153E59F01EB918036F5EB01B982FF477EDD386A20032884D793C069999F755E17A3BB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\Uninstall.exe
Size 3.6MB
SHA256 e40e81c3d9ce84fb1511518101ac2970ea863645e771bc2a98bac61730c21e25
MD5 88300fe92dc6c46d4aee5c3bd589b763
SHA1 8a407e68ff2268a8fde09fd85816bea11577194b
SHA512 0f30beece08b11bec3e766a56f18451c12ed5ea681c0e611fa01271dff816bdbaab74ad5afaf2418d0ff7e7bdfc05c2dcd017811e031cbb9093ae36efdf20dde
SSDEEP 98304:EaHC6MgAUD2Cad/sFNmtxxzYPYb3ouR7Nrk8:EafAUx4txit8
TLSH
T130069E12EE818072F59301B582B753BA9D376E30532485DBD3C019AA8B216FD7A3E777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\Update.exe
Size 3.6MB
SHA256 ec100d4fac5227f0ab62c55c2fa8f9bc6d42aadb4405cca213e0e4d097b8a77d
MD5 2230d404b187b40a6508b3f55f9dd0d9
SHA1 9643b01c49a0843c5143cac6beeeb0cbef42195b
SHA512 01c760c46a950f16b1438d7dca3d275080f457351a0a310ee22bc2163328f36e1890c9ece74e1c90a4394cd546667c2c51e63dbdf8503a6c7f8fa53f4a0f261e
SSDEEP 98304:P0lXfLrUC5vWZ3MXshEQq1xj6DXH/MksWpiv2P:PYLQuQOj6DX0ksWpiy
TLSH
T13006D013FA8280B2F5E30175557BAB7B4D39BA246734C5D397E10D698C302E2763E39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VMProtectSDK32.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\VMProtectSDK32.dll
Size 98KB
SHA256 6121e079745bbca9a1f0e7d93ba4d23d388093e48a5fd49641cb6f9af9038393
MD5 1557b7fbb41b9b2ff608a195ce947ec2
SHA1 1ce6e026b44dd8e10955092b51106ec9f3b6727b
SHA512 46c96e450b0b90c9bd90a65f5dd26e4b35d5914785213deb8c4279f462d5c2b431329e51608471c0e4efab82007982807ec3217185b042fedaec5b1add065ee9
SSDEEP 1536:IT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwD0YXowGF:whQC2mCYK3RhrZ9dPk2Q9yMJwD0YRG
TLSH
T111A36C10B4D1C432E0BE19390535C5A15B3E7930EF64AEDF73841AA99E742D1AF39E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca-cert.crt

Path C:\Users\Admin\AppData\Local\Temp\temp\ca-cert.crt
Size 1KB
SHA256 dd90c0363b07ae51052b37350c04087a6e3cbdc9ab14d11603da3b5397b3cf06
MD5 2fa3ee8728f79f126ab8d576606a0efa
SHA1 b230ae7d218eed5e3927c8e9e6d0e00fedda6f76
SHA512 55a79964bc8051147d0d5256cd756f706c55b82bb61ef9bab4877224aa48654a00e0026efe60a7ccb2f2c5c25fad22c555d467ef6e6c3b2b385e24fb04295aaf
TLSH
T1E331B24E5C087E95385722B2CD7F42640824409B2CE2EA3B5C263502C396F64A8EEC6F
MD5 SHA1 SHA512 TLSH

Submit Download

cef.pak

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\cef.pak
Size 1.9MB
SHA256 f260ed922959efcc78b64812bbb5eb6d885115c8efd13430c1553e08e48802de
MD5 36659e322381655d8a9f9986cba7fa6e
SHA1 e814e6d4336c199e682e841775976cf94ebe1079
SHA512 6311c665d568daf65be17396c7945cddbd72486552a409267c07da8f14f28d880087241d653dd2f145e198530af4e899db8e1500bbf52ee4620a79d19b73fd30
SSDEEP 49152:JwSIiDHSQCGIcsnlen35q7qgfjWr6OS8qBDk:JDGBhlj7qgkui
TLSH
T132952301ED946E27D6DBE17EF898A0225D39D08364B47C2CF0CE524DC7AC55A26B837E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\cef_100_percent.pak
Size 224KB
SHA256 ed436af64f8b76ff90e46669952ee8c9bbdf99824aaf2905479094758d8f8208
MD5 09efaa28d2c293a4fd558cd208b8ea4a
SHA1 50b95ec03f816f642355753f6ca03c3ac34be1f4
SHA512 1c3bf79ffaac5b275f382022baddcddad4e86de6dc0daaa336396e34ce963a48246f59700159231b279ad803aad8a8d10784abfffe80b282df44a1396ab32f5a
SSDEEP 6144:h756OxS+cf5IOtpztRrFrJzw95Txh90Gb0OveGe04mExhLY:hMOHmTtFoxxoORehrQ
TLSH
T1FF24E1D3B375EC3ECF63A6F3603561B5E877026C2FC2C2C94696C5366A1235899C8297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\cef_200_percent.pak
Size 298KB
SHA256 641e4bed1378c4e733d27e87d4700b1c67c675b9522739b2fb0f20bd31f1c3e9
MD5 b2faad274560cf08b8d2976d8bee80ad
SHA1 df49171eba7506fba9c2179fee768645f78e6550
SHA512 c82b1c24f1651d1af9ad47d62e9471c34e4c99470f029ec5f9c99e248272a53a9a6d1b26c43d41d800c80c110605f6e25ea16896e4869cc014435070f1a387f3
SSDEEP 6144:i56OxS+cf5IOtpztRrFriDQYaF+9bQHgs4jTlahCWGMRe8InVXYopym74:pOHmTtFrfs4gs4jTMo6ebVIo374
TLSH
T13B54F1D7E374AC3DCEB35AB3503561F1EC7B11381AE6C2CA42DAD8356A5279C88C9193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_extensions.pak

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\cef_extensions.pak
Size 1.2MB
SHA256 0a62ceb910fd4d0f7c9e81ac4d9b66e45f701d44462044c854447ad0a10ff913
MD5 3d5ce93f7f851bd2ca0c0e45a447e33f
SHA1 543f5b44ca00cda5b4575331b7a2939645635be9
SHA512 bb922804baacf1a5d203391dab6c2bbb87cadbe9d96305886e762803c0b1007e6f0a13f911bc32b723a2f49cd95daf720c2c9dcfffbfe85616c1c0d42f644979
SSDEEP 24576:FjL9cLtSpdbWhLrf7LbGaNu+91mt/oSmOcRfP+3af64ooIIpOT0b+g3x4GJ:FjLeo7ChDBNummtgBP+3af64ooIIYAKq
TLSH
T144552321FB59983FE1E6E370C86985766D1C04632AA5AC0EB1CA514E8F9D31413F26FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\chrome_elf.dll
Size 870KB
SHA256 61d9e498f1d803c605a256334d4a0d800b7de378f31bb5c92b9391cb8285d0e5
MD5 7210c4722f4cd55f34b3692006d32459
SHA1 d1d9901541b42c6fb3be618d72ca772158d717aa
SHA512 6a584971b1c810c9bf0af7119bdc9853f8a6447c7c19d7c1adeaa7c03280497079f35220ad848e46ff7e28b973073822049b686db36f2b3862d727d72f5046e2
SSDEEP 12288:ltxy8K8mTwpHeaPB6pe1F6aFkWTbfjaSf0XMzBuP9OskLVeQ5+nQQG9v:ltxy8KbTwReaPMC6aFF+SMOBsU9
TLSH
T18F15AE02F841D035D4422535912CF7396B3DE6118F348EDBD3D49EAAAFB05D1A63A2AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_43.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\d3dcompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
TLSH
T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\d3dcompiler_47.dll
Size 3.5MB
SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
MD5 f76b1d2cd95385b21e61874761ddb53a
SHA1 e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA512 8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP 49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai
TLSH
T184069E20FB058176D8CB01B2A59D7BB6A47C9B31473440C361B4AE99FD712E32F39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devtools_resources.pak

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\devtools_resources.pak
Size 2.2MB
SHA256 8b50cfbff2dc704c4584dc79e896a26c715bcceba850770c59e170737a9cafc4
MD5 bffdbb111baad50697126b13b25a1fac
SHA1 4c120fac1632b6f1f9d1bdb69cb603411a8c6b7a
SHA512 c466caa6bcce25e87b6f0dda252a949e290b13421bce1c1186133b6e25c8ac02b1c11045b437d5221f1e6c9472bd88d2816022bc88dc8dba6819758ef4849fc4
SSDEEP 49152:QDYcFYhfLSntlqh0qANBsCiLTMajb0D8m//9rwz3sT:QTJntwyqWBsCiLeD8crwra
TLSH
T121B50216A2E1283BC6DA31767C6BA105B770444B005CBD7E7E9D52DCAFA082841BEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\libEGL.dll
Size 321KB
SHA256 dc9969afa48e68f55636befee2178fd6f318bfbe4cf0c8444d45eb2fbe0d2a49
MD5 3546315b0c23dcda990f010c252fe4e6
SHA1 8dbcaa5f9115c5b4f2204f590b9d5803939e0de5
SHA512 57a62d036d45994cc9e754c0e02f8285e43b714d09028217ca8cf7339836201419f10a6430dc01858f814c05c0761b75e6e9ad5bdf36473e4fa69c33a2f2f9d7
SSDEEP 6144:k07M4TTJlasBzS8ltvvLX3diytbOOR+sGN7X3etGuYtRy/SuiscX4vbGV5k:k04wJXxdi2bOOW3etGb1uiscXo05
TLSH
T17E649E00B940C036D99F10347529E7794A3FAA711FA0CACBD7944EAD9F712D09A36B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\libGLESv2.dll
Size 5.5MB
SHA256 f39c6aafc26af2799ed122e19c76e6bed1b4da2fedb2c68e877da553a9c61cc5
MD5 c649a750558b24ad41dfe1d00da57b3a
SHA1 cb26e1947bc3194ef955a7d3c794d6e7050684f4
SHA512 edd95923ed3afba9cccf3b7da67655dee318d64e7fc3edd562147e36e58685ac835983ebe71ad589d03f25723a6206f490ddc2b691e84a64f0be7be31c09407b
SSDEEP 98304:GiCBnYoMorkDThINZ3E5S3VACoCn5f7pAv2R:GVBtMo6mE5oVzLj
TLSH
T14C468D01A48180B6D84B61721B1DBB3E6B395B061F21CBC7EB98AC95BFF42D0277615F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\natives_blob.bin
Size 402KB
SHA256 7d9c0c4d88618bdd16bb0681fdec1dd736e2ed1141ae527a27b22fb93f27848f
MD5 8f4d6515f4d321313a39a659c3c5ff01
SHA1 f4c95f1abd24c715a3dd4b3e4c9cff5decda7250
SHA512 3c00eb9a8ca8d076140df0071cfa702e1c032edbc20481bb7f7b7a88c1a82c959b8ac901182c2f9d235f55b4528c8e12b1e765119f1e784645c61f66c1c2b007
SSDEEP 12288:ln3Cj7CQaMiyMzQ77Ua7Zm6ap4avfyM3G:lnk7CQWfy9
TLSH
T168940999BD95AC9342F344F8441F150DBDBC89689468D098F2CDC8E11BBA226573BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\plugins\manifest.json
Size 2KB
SHA256 f71cdbf791d81a2a736c4da31130c153e405f2cb268078dccb0d6bf6c5ef055b
MD5 ffb32fb3b3c7915b059194ec74764e4d
SHA1 75adc04795e25f2bb20b82ce6763ab136fa20a79
SHA512 aeb7224f60176ca4de8119c05c593d5681747995f48024b4783e219099e68a6fdfe406d5f824c882ca3718b0bd879de35b9a9edda26bd10d37e331010f9b7188
TLSH
T19941EFBFDBF15C22D80A91885C910E25BB836407F2949E87B3BC390C0F4EBD93499326
MD5 SHA1 SHA512 TLSH

Submit Download

pepflashplayer32_32_0_0_101.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\plugins\pepflashplayer32_32_0_0_101.dll
Size 17.1MB
SHA256 9398c530df138707917ab9d661acfb8ba355d2ccbcd308e3553411a0a53aa6bb
MD5 ca0f6644ee956810b006ccea3078457a
SHA1 581f1aa7b4662ff9732b3e251fea560c18e58875
SHA512 e5e7002c3e2a5057d27e40f9efb5404e2a1c99bcde1c6747eac097324feb0d70a43a1e8875e143fd7feeda77ff2843ec1771c62236c9cd74a4533f796cc9a007
SSDEEP 393216:3TO2YX0Qohjguva/D8TwmlH9SkqN5IzB1nEv8:3TjaoBgIa/MeN61nEv8
TLSH
T1DF07C033AB8381FACA4A20B1643EB72F657DAA25073481C393D45D466A713D29B3774F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\snapshot_blob.bin
Size 46KB
SHA256 6113b12f3e3174b83c42aa98d5e43e5af7e986a6d56f95b97fca1ca4c0287735
MD5 00c91d5f5fc2752d59cc35d33b9d6063
SHA1 db0685a7c8e5c1bd8507abad499e1858231780b7
SHA512 1504deb6c53164d780ae0dedc41ec8bf869159f2b08a84f6fb67d5bb9fac08ec108718e7577c00c234bf52f9fd939bbd6e051e66ab36a4b102d6df00fcf65c7d
SSDEEP 768:ItpYJ9K+aBcYSCzo6BS9Z7O6VR5ItxoE7r81EKNY5kKdiMtpiPtukvepno/13q8S:ItpYJ9TaBqC039Z7O6H5KxoAAEWklpiY
TLSH
T18823026B4CF614D3D6B6683D41EE7F2C67A389C3349693A25BB3C1E10DEB03590A9B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\v8_context_snapshot.bin
Size 160KB
SHA256 8df1b08f69e961c991438b1f59116437ec3a8a23aadac1f89abce3e1d79497fc
MD5 8e09936533fb4d220c70d2a6890b8a19
SHA1 cac6b8e2c5b297db83776b5f4a17f3eb34dc7b8b
SHA512 e6ad1ce597ede098f13302c46f53fe7fe1c5ef8ac94cf89d48c85cd0c46e58f194e9af1238772e914117affde7a7c25d2d4c3e0c1f6f2abe900d4b910abe2a61
SSDEEP 3072:fM8biUJCT5669nfLjkeWmOJUbcpLRj7iYra3Q3jryFjvIAJuHyF2nCEHSUuF+zBY:f7lQH9/8mOJL97ibA3/yFbW3npyUHzBY
TLSH
T1D7F31206EB998CC2C88DB4B53ECFC0C7F2251009B9C6A9425BC5DB383962755ED5EB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdmadapter.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\widevinecdmadapter.dll
Size 178KB
SHA256 e81104f5e740458423f46028f115d2ed64e4bdaa6d1da7437db85e4788cc6f10
MD5 f480cc590b124f89a03fd921510fccba
SHA1 e1b5d75c95acbf32ff89f80c1e294b8f3fd852f6
SHA512 695491a063a3bd0bb6fe82d9eb343bbebba798952a9917af5f9088688c0f8d9cc72a9098766a7f098d935f20608883a38c5f58ee743bd99be6ec59b3248f4145
SSDEEP 3072:1ad0m2cq3AmQ6pZT84akUXJ8aiCKDSUP+eWEGcu723s:1ad0ZcUTFXI4apKa8PEZB
TLSH
T135046B1175C4C075D3BF033A89797A1426BDBD600EB6EB5ABFAC8C4D1EB4080AA75763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.txt

Path C:\Users\Admin\AppData\Local\Temp\temp\cef\wow_helper.txt
Size 65KB
SHA256 1f9103af0bb28f1d15874877e4901602808719a416a5212f7f65666c4567b4d7
MD5 9f1ae66d7954fe2e0909a5ebc6b94798
SHA1 d77e9e52ff57f2cce8a1783e88a7638cb0dcae2c
SHA512 ce4ed5245ce94e0edf87eafdb5730f15b5286894c7508abc20e96612d91d7e29e59a5589e1f07f36d567f4c0f8d88004440c7031cae32329ce404b276b1b6a8c
SSDEEP 1536:hf77+031ru/qpap4qUqm+rIqRqEp+85LQyiY:JWo1/op4qUqfrIkb+aLQ8
TLSH
T15863598A729140FAD4A781BC88D28A46EA71F01517B223CF533AC7A65F337D85E3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

curl.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\curl.exe
Size 3.2MB
SHA256 b1459397dedeff1cd750fc1cd62bcce9643b3e2023157df94c0975d4ded3712a
MD5 980c3e20533c3cf4e8240d8bd7cadec5
SHA1 7b68ad9fdfd678c6d3887121275f02ae89ba645d
SHA512 02ef32a880ca100d7554ea2e21039ba238201b1bd003fe96fb6e80743ae7951de48de6374e536f21c79331be59c6a4aaac6b2d484fb1886ce180310ed8ec7c45
SSDEEP 49152:9qa6aVMskefk2uRdbCqNsuNMNZqiLal2E4S5IgMP1i7FpwGCBbRtb8Yh:bk1aQz6HqiLi2E43PP1i70GUSYh
TLSH
T1DCF59E13709451F8C95AC034DB478627AA75B09E2F3879EF119897B03F96ED12F3CA68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\libcurl.dll
Size 422KB
SHA256 d1dea7adc762c684f0fb6c54015bf444d1f2c9616cb2132fc03680dfeb09b7b5
MD5 90c219a30be18b83d18274db4f3a398a
SHA1 ae59f90c2e8c0ebc36d2acca61fe3867268c806a
SHA512 dbcc2459f57e7fb9b30eb97dea438108431475d0d669e31adc881b4ba8191c29ea68ac227f5ce094aec362aefa415b1483708c7a27f65b446f6af2c2f4dd3365
SSDEEP 12288:okNWOlWAHS8Emf9WBzPtot1RWf0DfOUgDdiqtErddsbriXkv:oq78At1RWRdiqGddsyXkv
TLSH
T1FB947DA2F881C032E5A61135A2FD5BB36D3D6631373CD8D7A3904879AE701D27239B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GGImgTools.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\GGImgTools.exe
Size 504KB
SHA256 11b57521e44368c88255db43d32911676b779a3ae25709ccf7195b66230e3a17
MD5 92e023834978d4f892f7a618a6b218b6
SHA1 8aa93223d33b1a8500f6c86794f660812f68d150
SHA512 1cf93f3d7f6983ce12a8c9265810d1fe5abd3c6af843b29af270b91a71199b7cfc31a1694b42e073cd36cc1b7c3648ab27e2007c41807bb0f0ad731618c0dfc1
SSDEEP 6144:sVLQB29HsnJHfcB+qPGIa1vizxODezgFpWF+KSwXXZExoh3UU+dsQ0jfumnIV4:sVUumEB+zvEOKkBKTsoJUUs0jumnIV4
TLSH
T144B4E417A6DC3CEAD0368274A77797C5D72EFC4903A0C69F12E402569E3E2927D3A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OssImp.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\OssImp.dll
Size 777KB
SHA256 75297e0dda70d6bd433c7d12329ea1864875e46b76f898386e535def0c633600
MD5 e213f881dae24487d3314332fbbbf253
SHA1 f31c238182cc37e0c6540c943074814a6b0b402e
SHA512 0368c005e7970abe6a813866f0fd218fa1f6e5c28bc731f60e48a14a58c6b0e3d6306589bb19c3968c6b5a69770a19ec0d6f2df4f316cbbda12cfb556f57cced
SSDEEP 12288:I4QlaZLPkNLtenUSW7AFCUZTyzpBjmPLLeJHcoCM3a2krvNKW1s7dN+bOuXhgYY2:fQIZLPwQnukLmOeJaoMuIKsocs
TLSH
T1D8057D5A3A9C40A8E177A13889875A06E7B1B45613719ADF13F047AF2F67BF11E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\libcurl.dll
Size 369KB
SHA256 aeed15aa1949050d0c2bd3b9d2d7f0af8dd2cb544ab0b7efec070da533db5a1d
MD5 79da7507ead61b2b6cd2060a2ffaaa5d
SHA1 bd6aa8c56c3bba171a23d14db6e5cb60d014ad57
SHA512 26b8d4d35c1c308b28d7447777e14acde4edbfda8c441cc89bb53b0e386e2e083d0670839324e00eea96618b0e31df2f851cedb19b63a4c2360fa938d11183e9
SSDEEP 6144:ydsk3hbEhx9utjnmleNJPfozjSpvuMnv6KCHU/T9A0sh95d+DVUzojoa:fk36PQZmlIFuVMnyK8UEel
TLSH
T18A846B46F3B414A9E597D038C9138717E6B2B46D2311A7DF47B08B6A2F13BE1763A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\libeay32.dll
Size 2.0MB
SHA256 9462951326bc42a99533f75f191e8f527de5575aedb43229559a677b973766d3
MD5 af94333b32b5600d81399f44ba33c41a
SHA1 f4fdac998c0e143bb838bb038c6f5a6f0ed8f463
SHA512 cd5fa74ec507d48c003ac7bb20632cdb2e8de0d2222982d98579a8a451bc799039f000ebe8bed7e8670a81f488451903d747951b9eb8b0306648de732e1aceb1
SSDEEP 49152:tGtlqPRVwASOS99SeFMrqqMvqRV9t6wbOjD9NIU6iOn1XGq8uTPI:gJquwbOs+WWq8u
TLSH
T12CA58C1A9A5810E5D6BBC27C94778633A3F1B45503B0EBEB4A68C5B80F53FC9627E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\msvcr120.dll
Size 941KB
SHA256 0d00bf1756a95679715e93dc82b1b31994773d029fbbd4e0e85136ef082b86a9
MD5 e2ca271748e872d1a4fd5ac5d8c998b1
SHA1 5020b343f28349da8c3ea48fb96c0fbab757bd5c
SHA512 85d6bcaaf86f400000cf991da1b8e45e79823628dc11b41d7631aa8ee93e500e7da6e843ea04edb44d047519dabef96dcb641adc2a7b3faa5cd01e8a20b1f18e
SSDEEP 24576:lQ39+j16xw/86yY4ZOVqSs8cKPkb3vi4vwW1kCySQmWymTXY:S3tPDLfRbiow9Cyo
TLSH
T19925BE4676A106FAD463D2B4C9679607E2B2B85B1530D7AF02E08A6D3F23B30975F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\ssleay32.dll
Size 345KB
SHA256 11451c44e9fd3af5763f2b24e477eb4c180984ed01bb475a8b591e27d6814f1d
MD5 0e3630d64f2c2275e27bf8d22a0b27af
SHA1 f01b6fdaa3bc0a1c512c3d0a16ed9bf151f13cb3
SHA512 c68ce7c4ef663b5eb0493b079d216c9cff4df3be65580ccb9b95436a6e34c91d931feb6de4029bc050d11da27620311e1569280b4781c096e5e57a02b71bb96b
SSDEEP 6144:jOZ9AMy7dfuSmipbqQET1F7vsOzEIGq3p2iOgklquJmXugZfCRGSJ9fdrr71kLu2:E9AMy79uSmipHET1F7vsOzERq3p2iOBV
TLSH
T180742A4266704C85DCD3C278C2674BE3FB75B82213789FC71B26856E0F637C4667A2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlibwapi.dll

Path C:\Users\Admin\AppData\Local\Temp\temp\shot\zlibwapi.dll
Size 102KB
SHA256 600a58a9d9a898955e8debcfc9e4e52eb06f01bc781bdae836f9dfe656284f60
MD5 1a73b3d3e4467fd99936b9887ac98a6c
SHA1 071e382b801533328626c07f870f6a12287d28d7
SHA512 71acf6d1eb3dfe9e850f6665abd2aebddd693ba3f19b44b827c1ea3edd86f93f3366d16ecc7139f225bf9ce1071d07bbbcd1238a79ab58292e5c8f51bc559cb7
SSDEEP 3072:KkzVBuq+cqUCcMIGlc2TTbTBfirSmBuM:KAVX++Ccu22THTBKrSmBu
TLSH
T1BAA37C9A6AA552B4D6F7A278D8D20F2EC3B0301403A04BCF465897A51F13BD95E393FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.xml

Path C:\Users\Admin\AppData\Local\Temp\temp\update.xml
Size 10KB
SHA256 8e2100747dd5264cb8235f9d3034043c7e15cecf3d4cbeb88f1d5f5a3b7eb892
MD5 64e835353d90f4e7d9df493b395642b7
SHA1 e50251b744d7bf4c16bb0a7c9fa50d19ffe4113d
SHA512 6a8493da728fcd676afccef821a91e0b0b9a2137b8d85dc79976d58b442991f00c7e3a4de04c0a80c8297d94e16eda2c493181a1e6bb5ee8bf885fa67d897ffb
SSDEEP 192:4UU2vrQWW+zACW/wPtK0Y8W32E7omzDWR886QZFFw6wUAkzOX2i3iAaNJ9tnLfei:vU2vrQWW+zAVIPtK0YHmE7omzCR886QL
TLSH
T13C22CE6659D78D6BF26163D98F02C96CBB269BCB801D410A3746648B3E2721F12FF0F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuhaoclient.exe

Path C:\Users\Admin\AppData\Local\Temp\temp\zuhaoclient.exe
Size 3.6MB
SHA256 299469f32abbe9fb8320ec25e71d20dabfba6582d7a67e8bcbeeaf322ab94906
MD5 c7e9800fec6fa123743ae21e69c8543b
SHA1 cc0f7ff0d2e2131011c122d263479c31f5beb0d4
SHA512 23f48ccc5b2ab96f1ae0811637ff6f8b7938211c6b54c775835484a6d02588a861ae4cfb89d6fc89927cfc73298ee6d670184844d7ef02297b2439ab9ec14532
SSDEEP 49152:bmI9trZ/YbNDIQEBmgwIRTgGBFL0hkV7UQA79K8CTVycPe7NrpHVFQUySmLD4qeP:bZtNMDIQOmlIRkEF0kV7U7s89p7NreE
TLSH
T15206AE11BB418132F9A300B649BF577E893CBE21131494C3E3D87A6E4F716E27A3665B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\webdata\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 65d4bd308b56b8f5c26fa90466c59e89ec916d9b41eb096846f76e6cbd7fe45c
MD5 14438d7d1895223994336b748d872f36
SHA1 fcf3d02f35fb6cc54182e2c55f9ce0fd1bab5b86
SHA512 6a6e58f42af94bbfbec2aee8612e7cb34958dccd7da239d38f39574dc399bbabcbd14f4bfcd1b7bb3d1c53b0e008857ad1f48d0c56ebcd15752cb871e19d9ff0
TLSH
T17DD012F284A41020C304C6B520CAC4013130DEA7F3030E34A8BCA4317C32F01C101A20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b701c.TMP

Path C:\Users\Admin\AppData\Local\Temp\webdata\Code Cache\js\index-dir\the-real-index~RFe5b701c.TMP
Size 48B
SHA256 9e1278dc7ec893e46622f43398d48e129b18026a88673b6cb312b0a386a91676
MD5 327c621527a7a13e8674035eae44b5ef
SHA1 2decf72cb0fc81805af805ae3fb9fda05e1f5fe0
SHA512 ad1f8fabeab6ad2aab6b7c980e822c2470ff98d419c96c2cb553eb699957fa2409ca8670f1cbfe29264df3e1ffa6080a4147aa679c5fb189d852f2be27f6c34f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\webdata\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\webdata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\webdata\TransportSecurity
Size 371B
SHA256 0c0ba0842c9608541aab7327e1447ee8b2628cd533345987eaa2a344e2d24d0a
MD5 650428d6e23ce40e43161f84df783b97
SHA1 7fad41c92f008424d89c53bbc5772fed3026956c
SHA512 8979fc2953c4df6c1ea3d097caf1937d6cad99d012ec435e47da656a759dc3e18915085562b83d1b5cf7a7e652ae012b5eabadfa04f5f206cc47d80870bf3ab3
TLSH
T174E06892582EE733102C0A660D08FE052FF6E034124154F4CAD7416CB0D54AA6A8F022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5b46ba.TMP

Path C:\Users\Admin\AppData\Local\Temp\webdata\TransportSecurity~RFe5b46ba.TMP
Size 369B
SHA256 a671a132eaebad8b16aff3426e76e7baf1be386f2ddaa9320fed9bc6f690eb06
MD5 4dcead3d89159bd6114031a368756845
SHA1 1f01e376ce529643977714bcafacbb99bff247b9
SHA512 8bf600485d9da1903d98d64750127c802e75181300061f678305e8458bcb9881f84b777076db2337eb47883b02a8720241786c80df2fc6337ea137a71c3158f8
TLSH
T196E0D862596EB537106C0E621E44FD056FF6F03502C15CF9EED382EC70965EA565A022
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2512-656-0x000000006A4C0000-0x000000006AAE4000-memory.dmp

Download

memory/4512-683-0x00000000078E0000-0x0000000007900000-memory.dmp

Download

memory/4512-686-0x0000000007A60000-0x0000000007A7A000-memory.dmp

Download

memory/4512-679-0x00000000078A0000-0x00000000078D6000-memory.dmp

Download

memory/4512-677-0x00000000066F0000-0x000000000670E000-memory.dmp

Download

memory/4512-680-0x0000000065EE0000-0x0000000065F2C000-memory.dmp

Download

memory/4512-684-0x0000000007920000-0x00000000079C3000-memory.dmp

Download

memory/4512-685-0x00000000080A0000-0x000000000871C000-memory.dmp

Download

memory/4512-678-0x0000000006730000-0x000000000677C000-memory.dmp

Download

memory/4512-687-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Download

memory/4512-688-0x0000000007CD0000-0x0000000007D66000-memory.dmp

Download

memory/4512-671-0x0000000006220000-0x000000000657B000-memory.dmp

Download

memory/4512-661-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/4512-662-0x00000000061B0000-0x0000000006216000-memory.dmp

Download

memory/4512-660-0x0000000005930000-0x0000000005952000-memory.dmp

Download

memory/4512-659-0x00000000059C0000-0x000000000600A000-memory.dmp

Download

memory/4512-658-0x00000000051F0000-0x0000000005226000-memory.dmp

Download